View Issue Details
| ID | Project | Category | View Status | Date Submitted | Last Update |
|---|---|---|---|---|---|
| 0002846 | unreal | ircd | public | 2006-03-05 13:35 | 2007-01-09 08:00 |
| Reporter | djGrrr | Assigned To | syzop | ||
| Priority | normal | Severity | tweak | Reproducibility | always |
| Status | closed | Resolution | no change required | ||
| Product Version | 3.2.4 | ||||
| Summary | 0002846: Channel mode +u hides all normal users from global opers, unless oped in the channel | ||||
| Description | one thing that i noticed is that when you use the mode +u on a channel to hide everyone except ops, even if you are a global oper, you still cannot see the users in a /names #chan, unless you are oped in the channel. This can be a security risk, because you could hide a botnet with it, even from opers. I know that its fairly easy to use set::restrict-channelmodes "u"; to prevent non-opers from using it, but it is also quite annoying, to say, if you are in a channel with +u set, and you get oped, you must do /names after you are oped in the channel before u can see the other users. Obviously, my request is that global opers and higher should not need to be oped in a channel in order to see users that would normally be hidden by +u channel mode. | ||||
| Attached Files | umodeuchange.patch (654 bytes) | ||||
| 3rd party modules | |||||
|
|
No security risk, '/who #chan' works fine. We did not exempt opers because that was getting too complex, it probably will only be added in a full rewrite, which will not be done anytime soon. |
|
|
yeah, i knew that much, but still, most clients don't use /who to populate the channel lists, so its a hassle, and i don't see how it could be hard to exempt opers from this; if its possible to do it from /who, why would it be hard to also add to /names ? |
|
|
................. |
|
|
I think an oper should know to /who a chan, if not, he/she/it should be fired. EDIT: And what is with the duplicate bug report? I think they should both be deleted. |
|
|
like i said before, this would not be too complex, since it only requires 17 extra characters :P I've made a patch and added it, do with it what you will. Maybe it could be something for 3.3 ? |
|
|
It is a bad idea because it forces opers with override to override. The current method for _everything_ makes override an intentional action. Here it is accidental. Bad news. Also, the point of +u is to prevent demonic hell of joins and parts in a really large channel. I, as an oper, don't want to see that. Let the opped bot take care of it. That's its job. |
|
|
if i didn't want to see joins/parts in a channel i'd simply just turn off join/part notices for that channel, not a big deal |
|
|
This can be closed IMO. If opers want to see who's in the channel they can do WHO #channel, and if they want to see join/parts they can op themselves. And I'm afraid your patch is not 'ok'... it still would only "fix" names, not show join parts kicks etc.. umode +u is not THAT simple ;p |
|
|
should be 'closed', not 'resolved' |
| Date Modified | Username | Field | Change |
|---|---|---|---|
| 2006-03-05 13:35 | djGrrr | New Issue | |
| 2006-03-05 13:50 | syzop | Note Added: 0011329 | |
| 2006-03-05 13:53 | djGrrr | Note Added: 0011330 | |
| 2006-03-05 13:56 | djGrrr | Note Edited: 0011330 | |
| 2006-03-05 13:56 | syzop | Note Added: 0011331 | |
| 2006-03-05 15:28 | Stealth | Note Added: 0011335 | |
| 2006-03-05 15:29 | Stealth | Note Edited: 0011335 | |
| 2007-01-01 12:00 | djGrrr | File Added: umodeuchange.patch | |
| 2007-01-01 12:01 | djGrrr | Note Added: 0012963 | |
| 2007-01-02 14:11 | JasonTik | Note Added: 0012969 | |
| 2007-01-02 14:14 | djGrrr | Note Added: 0012970 | |
| 2007-01-09 08:00 | syzop | Status | new => resolved |
| 2007-01-09 08:00 | syzop | Resolution | open => no change required |
| 2007-01-09 08:00 | syzop | Assigned To | => syzop |
| 2007-01-09 08:00 | syzop | Note Added: 0013041 | |
| 2007-01-09 08:00 | syzop | Status | resolved => closed |
| 2007-01-09 08:00 | syzop | Note Added: 0013042 |
